appycodes.

"WordPress is slow" is a symptom. We sell the diagnosis.

Real diagnostic engineering, not a caching-plugin install. We read the nginx logs, profile PHP-FPM, analyse the slow queries, audit the plugins, then we fix what is actually wrong.

Two hours into a recent diagnostic: not a caching problem. An ASN-level Cloudflare block plus backdoor remediation restored service.

/var/log/nginx/access.log, anonymised

Case 2024

# normal traffic
2024-XX 03:14:22 "GET /boiler-cover/ HTTP/2" 200 28102 "..." 0.34
2024-XX 03:14:22 "GET /assets/main.css HTTP/2" 200 14201 "..." 0.02

# attack starts, PHP-FPM exhausted
2024-XX 03:18:01 "GET /boiler-cover/?v=8a3f HTTP/2" 504 -    "..." 30.00
2024-XX 03:18:01 "GET /boiler-cover/?v=2c7e HTTP/2" 504 -    "..." 30.00
2024-XX 03:18:02 "POST /wp-load.php?x=4d HTTP/2" 200 1 "..." 0.41   <-- backdoor poll
2024-XX 03:18:02 "POST /v1/wp-load.php?z=a9 HTTP/2" 200 1 "..." 0.39

Before / after

Real numbers from a recent engagement

LCP
5.8s
1.4s

deferred non-critical JS, WebP pipeline, ISR-equiv cache, edge revalidation

PHP-FPM workers
exhausted at peak
head-room x3

pool tuning, fastcgi_read_timeout reduced, Cloudflare absorbing bot traffic

DB query count / pageload
142
31

object cache (Redis), removed un-indexed plugin queries, transient cleanup

PHP version
7.4 (EOL)
8.2

plugin compatibility pass, deprecation review, staged rollout

Things plugins quietly do to your performance

Six common culprits we've fixed in production

01

AutomateWoo bundles its own Guzzle

Conflicts with other plugins. The fix is keeping migration / cron scripts WP-free.

02

WPML doubles payment gateways on multilingual checkout

Symptom: duplicate card fields. Root cause: wp_loaded patch missing.

03

Themes with un-indexed SQL queries

Linear scaling with post count. Visible only at 10K+ posts. Fix: EXPLAIN, add indexes.

04

ACF on every page load with no cache

Costs ~50ms per uncached request. Object cache + selective wrapper functions.

05

Cart fragments on every page (Woo)

AJAX heartbeat killing TTFB on non-cart pages. Conditional load.

06

Autoload bloat in wp_options

MBs of option_value autoloaded on every request. Audit + remove.

What you get

Seven engagements

01

Server diagnosis

nginx logs, PHP-FPM pool tuning, slow query log, MySQL EXPLAIN analysis.

02

PHP upgrades 7.x to 8.x

Plugin and theme compatibility work that comes with them.

03

Cache strategy (multi-layer)

Object cache (Redis / Memcached), page cache (WP Rocket / LiteSpeed), Cloudflare edge rules.

04

Plugin audit

Identifying which plugins are quietly eating performance. Replace, remove, or fix.

05

Database optimisation

Autoload bloat, transient cleanup, orphaned postmeta, missing indexes.

06

Core Web Vitals

LCP under 2s, CLS under 0.1, INP under 200ms. Inside WordPress, not by abandoning it.

07

WooCommerce performance

Cart fragments, AJAX bloat, checkout query reduction, supplier-feed caching.

The performance stack audit

Where the seconds actually go

Eleven layers of a slow WordPress page load. Typical millisecond budget on the left, where we usually find the problem on the right.

L01
DNS
20 to 80 ms

Cloudflare resolves fast; legacy DNS providers don't.

L02
TLS
30 to 120 ms

HTTP/3 + 0-RTT on Cloudflare; older origins are slower.

L03
Edge cache (HIT)
10 to 40 ms

Where we want most requests to terminate.

L04
Edge cache (MISS) to origin
+ origin RTT ms

Wrong cache keys land here.

L05
nginx
5 to 15 ms

Healthy. Slow logs mean an upstream PHP-FPM problem.

L06
PHP-FPM queue
0 or seconds ms

0 is healthy. Seconds means the pool is exhausted.

L07
PHP execution + plugins
150 to 1200 ms

Where most fixable time lives.

L08
Theme queries to MySQL
20 to 800 ms

EXPLAIN + indexes. Un-indexed queries scale linearly.

L09
Response
5 to 40 ms

Gzip / brotli compression.

L10
Asset delivery
50 to 300 ms

Image pipeline, defer non-critical JS, font display swap.

L11
Browser render
100 to 500 ms

CLS fixes, hydration cost on heavy themes.

Good fit if

When a performance review is worth it

  • WordPress / WooCommerce sites with Speed scores under 50 and a real revenue downside
  • Stores with PHP-FPM exhaustion, nginx upstream timeouts, or unexplained traffic-driven outages
  • Sites on EOL PHP versions where the upgrade itself is the performance project
  • Operators tired of caching-plugin advice that didn't actually fix the underlying problem

Probably not a fit

When the problem isn't really performance

  • Brand-new sites with no real users yet, where this is premature optimisation
  • Pure marketing sites where Speed 90 is achievable with WP Rocket in an afternoon
  • Buyers expecting the bottleneck to be solved by a plugin install (it isn't)

Pair with maintenance and support for ongoing patching, Cloudflare edge engineering for the cache rules, security work when the slowness has a security cause, and technical SEO for the Core Web Vitals side that affects rankings.

Tools we use

Boring, deliberate, runbook-driven

Web server
nginx, PHP-FPM, fastcgi tuning, access + error log analysis
PHP
7.x to 8.x upgrades, OPcache, realpath cache, deprecation review
Cache
Redis / Memcached object cache, WP Rocket / LiteSpeed page cache, Cloudflare edge
Database
MySQL, slow query log, EXPLAIN, index design, transient + autoload cleanup
Frontend
image pipeline, defer non-critical JS, font display swap, CLS audit

Diagnose first

Bring the URL, the speed test, and access to the nginx logs.

Contact